Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-65592](https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q) n8n befor... https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q #CVE #ZeroDay #PatchManagement
Post summary
An alert is published for CVE-2026-65592 with a link to a GitHub advisory, but the post lacks technical details, exploit code, or evidence of active exploitation.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n8n | n8n | - | node.js | - |
| App | n8n | n8n | - | node.js | - |
| App | n8n | n8n | 2.30.0 | node.js | - |
| App | n8n | n8n | 2.30.0 | node.js | - |